A serious incident rarely fails because nobody cares.
It fails because several capable people believe they are in charge, or because the person expected to lead has never been given clear incident command authority.
That uncertainty is costly.
It delays decisions, creates conflicting instructions and leaves staff waiting for permission at the point where action matters most. In a crowded venue, retail site, transport hub or corporate workplace, minutes can feel very long when nobody knows who can stop activity, close an area, communicate with emergency services or direct staff and visitors to safety.
Incident command authority is not a title on an organisation chart.
It is the recognised right, responsibility and practical ability to make decisions for the response. The distinction matters. A senior manager may hold organisational authority but be absent, poorly informed or unfamiliar with the site.
A duty manager may have the best immediate picture but lack the confidence or delegated authority to act. Good arrangements resolve that tension before the incident, not during it.
What incident command authority actually means
Authority has three parts. First, someone must be formally empowered to make decisions within defined limits. Secondly, people on site must know who that person is and accept their direction. Thirdly, the appointed commander must be capable of making proportionate decisions under pressure.
Miss any one of these and the arrangement is fragile. A written delegation without staff awareness is just paperwork. A respected leader without formal backing may hesitate when a decision has commercial consequences.
A named commander who has never practised handling incomplete information can become a bottleneck rather than a source of control.
The purpose is not to create a heroic individual who decides everything.
It is to establish a clear point of command, supported by people with defined roles, so that the operation can move at pace without becoming disorderly. The incident commander sets priorities, makes decisions that sit within their authority, requests support and maintains a common operating picture.
Others should be able to act within their own responsibilities without waiting for unnecessary approval.
Authority is not the same as seniority
Many organisations still default to the most senior person in the building.
This is understandable, but it is often wrong. Seniority can provide legitimacy, access to resources and organisational influence. It does not automatically provide situational awareness, operational judgement or familiarity with the response plan.
Consider a large hospitality venue on a busy evening.
The general manager may be commercially accountable for the site, while the security manager understands current conditions, staff positioning, external agency liaison and the immediate safety implications. If the general manager takes command simply because they are senior, the security manager may be reduced to supplying information.
The response becomes slower than it needs to be.
The better approach is to define command by function and circumstance. The person on duty with the right training, knowledge and delegated powers leads the immediate response. Senior leaders provide support, take strategic decisions when required and ensure the commander has what they need.
That may include authorising prolonged closure, activating business continuity arrangements or managing reputational and stakeholder issues.
This is not about diminishing senior leaders.
It is about putting decisions in the hands of the person best placed to make them at that moment.
Private sector command has clear limits
Organisations should also be realistic about the boundary of their authority.
A private sector incident commander controls their organisation’s people, premises, information and immediate actions.
They do not command the police, fire and rescue service, ambulance service or other responding agencies.
Once emergency services attend, effective command depends on liaison, accurate information and a willingness to work within the wider multi agency structure.
The site representative must be able to explain what has happened, what actions have been taken, who remains accountable for the premises and what resources or risks are relevant. Trying to retain control of matters outside organisational authority is unhelpful.
So is becoming passive and assuming that external responders will manage every consequence for the business.
A capable site commander understands both responsibilities.
They maintain control of the organisation’s response while supporting the emergency response with useful, verified information.
The authority gap exposed by pressure
The weakness is usually visible well before a major incident.
Listen to how teams talk during exercises, evacuations or difficult operational decisions. Phrases such as I thought head office would decide, I was waiting for approval or I did not want to overstep are warnings.
They show that the real authority structure is unclear, regardless of what the plan says.
They may also reveal a culture where people are punished for reasonable judgement but criticised later for delay. That is a damaging combination. Staff learn that it feels safer to wait, even where the risk of waiting is greater than the risk of acting.
Counter terrorism preparedness and Martyn’s Law planning can expose this problem sharply.
Organisations may have procedures, training records and named roles, yet still be unable to answer a basic question: who can make the immediate decision to stop operations, restrict access, move people or communicate a clear instruction?
The answer cannot be it depends without explaining exactly what it depends on.
There will always be judgement involved.
Incident command is not a script. But the limits of discretion should be understood.
Define decisions that can be made immediately, those requiring escalation and those that must be referred to external authorities.
Keep the wording practical enough to use at 2am, on a busy Saturday or during a confused handover.
Building command authority that works
Start with the operational reality, not the policy template.
Identify the incidents that could realistically disrupt the site or place people at risk. Then identify who is likely to be present when they occur. The designated incident commander must be available across shifts and locations, not merely named because they are senior.
Delegation needs to be explicit.
A duty manager should know whether they can suspend trading, initiate an evacuation, close an entrance, direct security resources, make initial staff communications and engage support contractors.
If they need approval for every consequential decision, they are not genuinely in command.
The organisation must also establish deputies. A single named commander is not resilience. People take leave, work elsewhere, become involved in the incident or may be unavailable when an event begins. Deputies need the same clarity, access to information and opportunity to practise.
They should not be treated as a nominal fallback.
Training should test decision making, not just procedural recall.
Ask commanders to work through realistic uncertainty: conflicting reports, incomplete information, competing priorities, an absent senior leader or an instruction that has practical consequences for customers and staff.
The aim is not to catch people out.
It is to see whether they can establish control, decide what matters first and communicate with sufficient clarity.
A short structured debrief after exercises and real events is valuable if it is honest.
Focus on decisions, information flow and authority.
Did people know who was leading? Were instructions understood? Did anyone wait for approval unnecessarily? Did the commander have the authority they needed, or did the business discover hidden constraints too late?
Communication gives authority its effect
Authority that is not communicated has little operational value.
The incident commander needs a simple way to announce their role, provide direction and set a reporting rhythm. Staff do not need lengthy explanations in the early stages. They need to know who is leading, what they should do now and how to report relevant information.
Communication must also travel upwards. Senior decision makers need a concise picture of what is known, what has been done, what remains uncertain and what decisions may soon be needed. This avoids the common problem of senior leaders intervening with partial information and unintentionally disrupting the response.
The best commanders are not necessarily the loudest.
They are clear, calm and decisive without pretending to know more than they do. They state what has been decided, explain the immediate priority and adjust as verified information develops.
That creates confidence without false certainty.
Test the authority, not just the plan
A plan can state that a duty manager will lead an incident. A capability test asks whether that manager would actually act when the decision is inconvenient, uncertain or challenged by somebody more senior.
That is the question worth putting to any organisation. If an incident began in the next hour, would staff know who has authority, would that person know their limits, and would the business support a reasonable decision made in good faith?
If the answer is uncertain, the risk is not a missing document.
It is a command void.
Close it before an incident exposes it.
.
Useful Links:
.
